Inform the browser about mouse input in windowed plugins to ensure that we expect actions

which correspond to user gesture like downloads, external protocol launches, etc. Actions
occurring in the context of user input need to be allowed. To achieve this we send over
the WM_PARENTNOTIFY message to the RVH window which turns on user gesture. As per msdn
this message should be received automatically which does not appear to be the case.

All this means that we trust the plugin. However this does not add a new attack vector
as the plugin can send messages to other windows in the desktop anyway.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=41157

BUG=41157
TEST=As described in the bug.

Review URL: http://codereview.chromium.org/6592092

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@76566 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 11 insertions, 1 deletions

diff --git a/webkit/plugins/npapi/webplugin_delegate_impl_win.cc b/webkit/plugins/npapi/webplugin_delegate_impl_win.cc
index 149b1e8..1e82cad 100644
--- a/webkit/plugins/npapi/webplugin_delegate_impl_win.cc
+++ b/webkit/plugins/npapi/webplugin_delegate_impl_win.cc
@@ -1404,9 +1404,19 @@ void WebPluginDelegateImpl::HandleCaptureForMessage(HWND window,
   switch (message) {
     case WM_LBUTTONDOWN:
     case WM_MBUTTONDOWN:
-    case WM_RBUTTONDOWN:
+    case WM_RBUTTONDOWN: {
       ::SetCapture(window);
+      // As per documentation the WM_PARENTNOTIFY message is sent to the parent
+      // window chain if mouse input is received by the child window. However
+      // the parent receives the WM_PARENTNOTIFY message only if we doubleclick
+      // on the window. We send the WM_PARENTNOTIFY message for mouse input
+      // messages to the parent to indicate that user action is expected.
+      HWND parent = GetParent(window);
+      if (IsWindow(parent)) {
+        ::SendMessage(parent, WM_PARENTNOTIFY, message, 0);
+      }
       break;
+    }
 
     case WM_LBUTTONUP:
     case WM_MBUTTONUP: